Improper validation of certificate with host mismatch in Node.js - CVE-2026-106072
Published: October 26, 2026
Vulnerability details
The vulnerability allows a remote attacker to bypass TLS endpoint identity verification using a certificate with a numeric DNS subject alternative name but no matching IP address subject alternative name.
The vulnerability exists due to improper certificate hostname validation in Node.js tls.checkServerIdentity() when non-canonical IPv4 literals are normalized but not classified as IP addresses. A remote attacker can present a certificate containing DNS:127.0.0.1 without IP Address:127.0.0.1 when a client connects using 0177.0.0.1, 0x7f.0.0.1, 2130706433, or 127.1 to have the certificate incorrectly accepted for the IP endpoint.
Exploitation requires a certificate issued by a CA trusted by the client and a platform resolver that accepts these non-canonical spellings, such as glibc.
Affected software
Anolis OS
nodejs-npm
v8-13.6-devel
nodejs
nodejs-devel
nodejs-full-i18n
nodejs-libs
nodejs-docs
How to mitigate CVE-2026-106072
nodejs-npm - update to 11.19.1-1.24.22.1.1
v8-13.6-devel - update to 13.6.233.17-1.24.22.1.1
nodejs - update to 24.22.1-1
nodejs-devel - update to 24.22.1-1
nodejs-full-i18n - update to 24.22.1-1
nodejs-libs - update to 24.22.1-1
nodejs-docs - update to 24.22.1-1